test(security): the ungated-router list may only shrink, so a new entry fails (#16375)

[mrveiss]

Refs #16375

Stacked on #16896 (base issue-16375-gate-three-routers). Merge #16896 first, then retarget this PR to main. It is stacked because both PRs edit adjacent lines of KNOWN_UNGATED.

Thinking Path

#16375 asks that KNOWN_UNGATED shrink to empty, and that the baseline only shrink. The file said so in a comment ("The list may only SHRINK"), but no test enforced it:

• test_no_new_config_router_is_ungated_and_undocumented fails for an ungated router that is not listed.
• test_the_known_ungated_list_has_not_gone_stale fails for a listed router that is now gated.

Together they force the list to equal the live ungated set. Neither stops a PR that adds an ungated router and its list entry together, which is the one move the comment forbids.

I followed the repo's existing pattern for a comment that must fail (comment_line_number_citations_test.py's _MAX_BASELINE: "raising this number is the deliberate act"). A count alone misses a swap (one entry fixed, a new one added), so a frozen superset backs it up. No git-history comparison: CI's checkouts are shallow.

What Changed

repo_tests/config_router_auth_coverage_test.py only:

• _EVER_UNGATED: the 36 modules of fix(security): authenticate every skills route, and require admin to change, fetch or execute (#16368) #16370's first run, recovered from the commit that added the file (afccf73b4).
  • test_the_known_ungated_list_only_ever_shrinks fails if KNOWN_UNGATED holds anything outside it, so a new module cannot be parked.
• _MAX_KNOWN_UNGATED = 27: test_the_ceiling_is_pinned_to_the_list requires len(KNOWN_UNGATED) == 27.
  • Growth fails.
  • Every removal must lower the number, as a deliberate edit.
  • It also catches an entry removed once and later put back, which the superset cannot.

No router is gated here. The router-by-router triage and the next steps are on #16375.

Acceptance criteria

This PR delivers part of #16375: the "may only shrink" rule the coordinator asked for, which the issue's AC2 ("shrinks to empty, under its equality rule") depends on. AC1 to AC3 stay open, so this is Refs, not Closes.

Verification

• The count matches the branch: KNOWN_UNGATED on the base branch (after security(api): gate captcha, metrics and diagnostics routers (#16375) #16896) has 27 entries.
• The superset is a real superset: all 27 are inside _EVER_UNGATED's 36, and the 9 missing are the ones already gated: 6 by 9179f9305 (it gated 7, but knowledge_extract was never listed) and 3 by security(api): gate captcha, metrics and diagnostics routers (#16375) #16896.
• Pre-push ran it: the repo's pre-push hook ran repo_tests/config_router_auth_coverage_test.py and reported it passing. CI is the evidence.

Single-issue rationale

This delivers one part of #16375 (the ungated-router list may only shrink) and closes nothing: #16375's other criteria stay open, with the router-by-router triage handed off on the issue. It is stacked on #16896 because both edit adjacent lines of the same list, and it is kept separate so the guard can land ahead of the gating work.

Model Used

Claude Opus 5 (claude-opus-5)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• main
• release

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f0413d49-4f78-4f9d-8992-acd1c1ab313a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Notice: 29 open PRs — past the runaway threshold (25)

There is no PR queue limit, and this is not a request to defer this PR. Work proceeds one issue at a time without a cap on open PRs; review capacity is the constraint.

This notice only means the count is high enough to be worth a glance for a runaway — something opening PRs in a loop, or a merge pipeline that has stalled so nothing is draining.

Currently open:

• fix(security): A2A trust keyed on the verified pair, capabilities enforced where they apply (#16957, #16950) #16969 fix(security): an A2A peer's task is refused the agents its trust level may not reach (security(a2a): three of four trust-matrix capabilities are enforced nowhere — a level that denies them denies nothing #16957, security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(security): a delegated agent inherits its parent's authority; the originator survives relays (#16950) #16966 fix(security): a delegated agent inherits its parent's authority; the originator survives relays (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• feat(agents): live presence registry, one query across all three agent kinds (#16947) #16965 feat(agents): live presence registry, one query across all three agent kinds (feat(agents): live presence — one registry of named agents with busy/idle state, across all three kinds #16947)
• feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (#16951) #16964 feat(agents): wire QuotaHeadroomStore's read side, add provider/cpu/queue claim kinds (feat(agents): coordinate agents competing for shared resources — API limits, CPU time, queues #16951)
• fix(ci): audit 2 missing .secrets.baseline entries blocking every PR (#16960) #16961 fix(ci): audit 2 missing .secrets.baseline entries blocking every PR (fix(security): .secrets.baseline on main is missing 2 audited entries, blocking every PR's whole-tree secret scan #16960)
• fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (#16934) #16959 fix(infra): gate doc-sync to main-at-origin-tip, move it off post-commit (bug(kb): the doc-sync commit hook re-embeds every doc into the live KB from any worktree, because its hash cache is per-checkout #16934)
• test(security): a delegated subagent runs a write its parent is held from (#16950) #16958 test(security): a delegated subagent runs a write its parent is held from (security(agents): an agent refused an action can get another agent to do it — no per-peer identity #16950)
• fix(multimodal): the response says whether a result was stored, and if not, why (#16926) #16954 fix(multimodal): the response says whether a result was stored, and if not, why (bug(multimodal): a tenancy-refused write still returns HTTP 200 success — the persisted flag has no consumer #16926)
• fix(tests): prune SKIP dirs during the walk, not after rglob returns (#16601) #16952 fix(tests): prune SKIP dirs during the walk, not after rglob returns (ci(python-suite): intermittent hang in shard 10 — one of the 223 modules it runs on main (hit #16284 and batch 2b) #16601)
• fix(admin): add the missing adminMenuItems entries for pricing/mcp-servers (#16933) #16944 fix(admin): add the missing adminMenuItems entries for pricing/mcp-servers (bug(admin): the MCP-servers and pricing admin screens merged unreachable — no admin menu entry #16933)
• security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (#16457) #16939 security(websocket): every authenticated WebSocket echoes the bearer subprotocol through one helper (security(websocket): auth token travels in the URL query string, not a header/subprotocol #16457)
• fix(ci): chain formatter dispatch after the branch guard in pre-commit (#16923) #16938 fix(ci): chain formatter dispatch after the branch guard in pre-commit (ci(hooks): no local hook runs black/isort/ruff — formatting is first checked in CI #16923)
• fix(security): match injection patterns against what a model reads, not the raw text (#16354) #16937 fix(security): match injection patterns against what a model reads, not the raw text (security(detector): detect_injection matches its patterns before stripping invisible Unicode, so a zero-width character inside a phrase defeats the match #16354)
• fix(ci): size the trailer gate's fetch to the PR so a release is scanned whole (#16931) #16932 fix(ci): size the trailer gate's fetch to the PR so a release is scanned whole (ci(trailers): the trailer gate cannot see a release promotion — fixed fetch-depth 100 vs 808 commits #16931)
• security(rag): route the chat's RAG path through the content firewall (#16771) #16930 security(rag): route the chat's RAG path through the content firewall (security(rag): the chat RAG path builds the prompt from KB text without the content firewall #16771)
• test(api): stop racing the clock in the last completion test (#16928) #16929 test(api): stop racing the clock in the last completion test (test(api): test_completion_performance races the real clock, the defect #15861 already fixed in its siblings #16928)
• fix(security): break-glass repair of a genuinely unreachable knowledge fact or envelope secret, through each type's own service (#15779, #16940) #16927 fix(security): admin break-glass repair for unreachable null-scope resources (bug(scoping): a null-scope resource is denied to every principal including admin — un-repairable in-app #15779)
• docs(ci): the two PR gates name their importer, because pre-push cannot warn you (#16859) #16922 docs(ci): the two PR gates name their importer, because pre-push cannot warn you (ci(process): PR body requirements are undiscoverable before push — gh --body-file never loads the template, and the gate's author failed it twice #16859)
• fix(backend): resolve 4 duplicate route registrations (#16908) #16918 fix(backend): resolve 4 duplicate route registrations (bug(api): four endpoints are registered twice — the second registration is dead code #16908)
• fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (#14968) #16916 fix(kb): the RAPTOR tree is built at all, and its nodes cite their chunks (RAPTOR tree nodes are built with an empty source_chunk_ids, so no tree node can cite its sources #14968)
• fix(chat): the init stops at its first await once the component unmounts (#16274) #16911 fix(chat): the init stops at its first await once the component unmounts (fix(chat): ChatInterface's init keeps running after unmount, so a slow-init test crashes a later test's fallback #16274)
• security(ai-ml): pin HuggingFace model revisions and verify weight integrity (#13034) #16899 security(ai-ml): pin HuggingFace model revisions and verify weight integrity (security(models): no revision pinning or weight integrity verification — 18 suppressed B615 findings (#13030) #13034)
• security(api): gate captcha, metrics and diagnostics routers (#16375) #16896 security(api): gate captcha, metrics and diagnostics routers (security(api): 44 config-registered routers declare no auth gate, triaged by exposure (found by widening the router-auth guard, #16368) #16375)
• security(secrets): content-scanning credential redactor -- catches a credential in free text (#13708) #16895 security(secrets): content-scanning credential redactor -- catches a credential in free text (security(secrets): credential redaction is name-keyed and cannot see credentials in free text — add content scanning before mail is indexed #13708)
• fix(ci): python-paths covers the shell wrappers python-suite tests (#16249) #16892 fix(ci): python-paths covers the shell wrappers python-suite tests (python-paths: a change to only check-pre-commit-hook-pr.sh skips the tests that exercise it #16249)
• security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (#16457) #16891 security(websocket): auth token travels via Sec-WebSocket-Protocol, not the URL (security(websocket): auth token travels in the URL query string, not a header/subprotocol #16457)
• fix(ci): give the SLM backend's tests their own venv in CI (#16394) #16889 fix(ci): give the SLM backend's tests their own venv in CI (ci: run SLM backend tests in their own venv, so CI stops forcing the backend's websockets<16 cap onto the SLM #16394)
• fix(hooks): the non-git guards tell invoking a command from naming one (#14144) #16885 fix(hooks): the non-git guards tell invoking a command from naming one (bug(hooks): push guard matches the branch name in argv, so 5 forms reach the protected base unblocked #14144)
• security(infra): stop binding ChromaDB to every interface by default (#15317) #16882 security(infra): stop binding ChromaDB to every interface by default (security(chromadb): the vector store binds every interface in front of four unpatchable advisories, one a pre-auth RCE #15317)

If the queue is draining normally, ignore this. Otherwise:

1. Check whether CI is dispatching at all — see the ci-dispatch-watchdog status on these PRs
2. Merge the ones whose CI has finished and review has passed: gh pr merge <number> --squash --delete-branch
3. Look for a loop opening near-identical PRs

Warn-only runaway detector — .github/workflows/pr-queue-gate.yml. It never blocks a merge.